What is FlexConnect?

Understanding FlexConnect

FlexConnect is a Cisco wireless solution that lets lightweight access points at remote or branch sites switch client data traffic locally instead of tunneling all of it back to a centralized wireless LAN controller (WLC). This reduces WAN bandwidth use and latency, and it allows branch wireless service to keep working even when the link to the controller is down.

In the standard CAPWAP model, an access point tunnels all client traffic to the WLC for switching. FlexConnect changes this by allowing per-SSID configuration of local versus central switching and local versus central authentication. When in connected mode, the AP still coordinates with the controller for management; in standalone mode (controller unreachable), FlexConnect APs can continue authenticating users locally and switching traffic onto the local VLAN, preserving connectivity for the branch.

For security, FlexConnect introduces design tradeoffs that must be managed. Local switching means client traffic and segmentation enforcement happen at the branch, so VLAN mapping, ACLs, and authentication caching have to be configured correctly per site. Survivability features like local EAP and locally cached credentials keep users online during WAN outages but require careful policy so an offline AP does not become a weaker enforcement point. Centralized visibility and consistent policy push are key to keeping distributed APs trustworthy.

For example, a retail chain with hundreds of stores deploys one WLC at headquarters and FlexConnect APs in each store. Point-of-sale and guest traffic is switched locally onto separate VLANs so it never crosses the WAN, cutting bandwidth costs. When a store's WAN circuit fails, the FlexConnect APs drop into standalone mode and continue authenticating staff devices using locally cached or local-EAP credentials, so the store keeps operating until connectivity to the controller is restored.